airdrop[.]defi-app[.]world

This domain, airdrop.defi-app.world, is flagged for brand impersonation targeting the Sui blockchain ecosystem. Analysis indicates the site masquerades as an official Sui airdrop portal, a common tactic to deceive users into interacting with malicious smart contracts or disclosing wallet credentials. No specific drainer kit signatures were identified in the available telemetry, but the domain aligns with patterns observed in fraudulent crypto distribution schemes. Infrastructure analysis reveals the following technical indicators: the domain is registered through Web Commerce Communications Limited (WebNic.cc) and resolves to the IP address 104.21.38.63. It is flagged by 12 out of 95 security vendors on VirusTotal, and appears on one security blocklist. The site employs Cloudflare for content delivery and utilizes an SSL certificate issued by Google Trust Services. The page title, 'Just a moment...,' suggests the use of Cloudflare's anti-bot mechanisms, a technique often exploited to delay or obscure malicious content from automated scanners. The domain has been taken offline, likely due to enforcement actions or suspension by the hosting provider. However, residual risk persists as threat actors may re-deploy the infrastructure under a new domain or IP address. Users who interacted with the site should revoke any connected wallet permissions and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and associated IP, while maintaining vigilance for similar impersonation attempts targeting blockchain projects.